CVE-2026-2666
Published: 18 February 2026
Summary
CVE-2026-2666 is a medium-severity Improper Access Control (CWE-284) vulnerability in Mingsoft Mcms. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2666 is a vulnerability in mingSoft MCMS version 6.1.1, affecting an unknown function in the file /ms/file/uploadTemplate.do within the Template Archive Handler component. The flaw enables unrestricted file upload through manipulation of the "File" argument, as documented in the CVE description published on 2026-02-18.
The vulnerability is exploitable remotely over the network with low attack complexity and no user interaction required, but demands high privileges (PR:H) from the attacker. Successful exploitation results in low impacts to confidentiality, integrity, and availability, yielding a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). It maps to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories referenced in VulDB (ctiid.346463, id.346463) and GitHub issues (chujianxin0101/vuln/issues/11) confirm the issue, noting that an exploit has been published and may be used by attackers. No specific patch or mitigation details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7637
Vulnerability details
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack…
more
can be launched remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing CMS template handler directly enables remote deployment of web shells for execution/persistence after exploiting the application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of uploaded file content and type on /ms/file/uploadTemplate.do to block dangerous or unrestricted archives.
Enforces access-control policy on the Template Archive Handler so that only permitted file operations succeed, addressing the CWE-284 improper access control flaw.
Restricts the uploadTemplate function and permitted file formats to the minimum required, reducing the attack surface exposed by the unrestricted upload vector.